How to Hire a SCADA Engineer: 2026 Guide

Last updated: September 3, 2026

By Mike Carter, Director of Partnership Success, KORE1

Hire a SCADA engineer by screening for who owns the path into the control network, not who can build an HMI screen, because remote access is where these systems fail in 2026. Base pay clusters near $123,000 across every major aggregator, and a properly scoped search closes in five to eight weeks.

The screen-building part is real work and it is also the part everybody screens for. Tag databases, alarm rationalization, trend displays, a historian that does not fill its own disk. Fine. Necessary.

It is not what is breaking plants this year. Not close.

The Modem Nobody Put on the Drawing

A lift station at a mid-size municipal utility had a cellular modem sitting on it. Nobody currently employed there knew. Nobody had for years.

An integrator installed it in 2019 so the on-call tech could dial in at two in the morning instead of driving forty minutes across the county. Sensible decision at the time, and the tech who asked for it was solving a real problem that the utility had no other answer for at two in the morning in February. It never made the network diagram, because it was not on the network. It had a SIM card and its own path to the internet, one hop from the PLC running the wet well, still carrying the password it shipped with.

They did not find it through a breach. They found it filling out a cyber insurance questionnaire that asked them to list every remote access path into their control environment, and somebody who had been there fifteen years put down his pen and said the sentence that starts every single one of these stories. “I think there might be something out at Lift 4.”

Nobody had owned that question. Nobody. Their SCADA job description had never asked anyone to.

My interest here, so you can price it into everything below. KORE1 has staffed engineering desks since 2005 and we run controls and automation engineer staffing searches, which means I get paid when one of these closes. There is a section further down explaining who should skip this hire entirely. That one costs me money and it is the right answer for a decent number of readers.

Four People Answer a SCADA Posting

Post “SCADA engineer” and four distinguishable groups apply. Four. Every one of them describes themselves accurately. Sorting them is your problem, not theirs. Entirely.

Most companies need row one, quietly need part of row four, and then write a posting that describes row two. That mismatch is the whole reason these searches drag, and it is why a posting that reads perfectly well to the person who wrote it pulls eighty applicants who are all wrong in the same direction.

A small water district we worked with in the Inland Empire got this wrong in an instructive direction. They hired well. An experienced Allen-Bradley programmer, genuinely strong, liked by everyone. Eight months later the SCADA servers were still running an operating system that had gone unsupported, and the historian had quietly stopped writing to one of its two databases sometime in the spring. Not his fault. Nobody told him it was his, and across the eleven years that system had been running it had never actually been written down as anybody’s, which is a sentence I have now typed about four different clients.

If the split you need leans toward row two, our automation engineer job description template covers that posting in detail, and the wider engineering staffing agency practice handles the adjacent titles.

The Salary Sources Agree. Their Ranges Do Not.

This is unusual. Worth ten minutes before you set a band.

Four medians inside about $7,000 of each other. For a title this loosely defined, that almost never happens.

Now look at the spreads instead. Indeed reports a low-to-high band roughly $87,000 wide. Salary.com puts its 10th to 90th percentile at about $36,000 wide. Those are not the same measurement, and Indeed’s is the wider one by construction, since a full low-to-high always beats a trimmed percentile band. Even allowing for that, the gap is too big to be methodology alone. One dataset thinks this title covers a much broader population of jobs than the other one does.

The middle is settled because a mid-level SCADA engineer at a water district, a food plant, and a solar operations center genuinely does similar work for similar money. The tails are where four jobs got counted as one. Down at the bottom sits screen maintenance and tag configuration under close supervision. Up at the top sits someone architecting a multi-site system with redundancy, a historian strategy, and a segmented network behind all of it, and that person is priced against OT security rather than against controls.

Practical version. Budget $115,000 to $140,000 for a solid mid-to-senior SCADA engineer in most US markets, and expect to pass $160,000 in New York, where Indeed’s city data lands at $170,759, or wherever the role genuinely carries the network and remote access with it. Houston sits at $139,493 and Denver at $125,853, both pushed by energy and water rather than by cost of living, which is why the coastal-premium assumption misleads people on this role specifically.

O*NET, the Department of Labor’s occupational database, puts the 2025 median for electronics engineers at $130,220 and projects roughly 5,700 openings a year through 2034. Treat that as the floor for the occupation family rather than as a target. Floor, not target.

Our salary benchmark assistant will run your specific metro faster than a spreadsheet will.

Federal Advisories Rewrote This Job in Six Months

Two documents changed what a SCADA engineer is responsible for. Both are public. Neither one has reached most job descriptions yet.

In April 2026, CISA, the FBI, the EPA, and partner agencies published advisory AA26-097A, updated again on July 22. It describes Iranian-affiliated actors reaching internet-facing PLCs from Rockwell Automation, Allen-Bradley, Schneider Electric, and Siemens since at least March. Read what they did once they were inside. They modified and deleted project file logic, including Add-On Instructions. They disabled critical shutdown and alarm logic. They manipulated the data displayed on HMI and SCADA screens. They ran Dropbear SSH on victim modems.

That third item is the one to sit with for a second. The operator watching the screen saw normal. Normal was a rendering choice somebody else was making, which means every assumption your control room runs on, every alarm your night shift trusts, every trend your process engineer reads on a Monday, was downstream of a decision made by a person who did not work there.

Then on July 30, CISA issued a separate alert to the water and wastewater sector describing a significant increase in actors targeting exposed PLCs at utilities of every size. The tactics were blunt. Almost crude. Change the PLC password so operators are locked out of their own equipment. Change its IP address so it vanishes from whatever was polling it. Consequences ran to boil water notices and stretches of sustained manual operation, which at a small utility means people physically standing at valves in shifts. Rockwell’s MicroLogix 1400 got named for specific guidance.

The mitigations CISA asks for run three sentences. Disconnect the PLC from the internet. Turn on password protection and change the defaults. Allowlist IPs so remote access only works from known engineering laptops.

Every one of those is a SCADA engineering task. Not a SOC task. Nobody in your security operations center is going to log into a MicroLogix and change a password, and if somebody there did, you would want a very good explanation of why they were touching a wet well on a Thursday.

The standards side has been ready for this for years and goes mostly unread. The ISA/IEC 62443 series splits responsibility across asset owners, product suppliers, system integrators, and service suppliers, and organizes control systems into zones and conduits along the Purdue model. A candidate who can tell you which zone your historian sits in, and what is permitted to cross the conduit into it, is telling you something no certificate conveys.

None of this turns your SCADA hire into a security hire. It makes about a third of the role security-adjacent, permanently, and that third is absent from the postings competing for the same candidates. Where the situation is genuinely security-led rather than controls-led, our cybersecurity staffing desk runs those searches instead and the intake conversation goes somewhere different.

Ask Them to Draw the Path In

One screening exercise outperforms everything else we have watched clients use on this role. It takes eleven minutes. Sometimes nine.

Hand the candidate a whiteboard or a shared screen. Ask them to draw how a person outside the fence reaches the HMI at a plant they used to work at. Vendor VPN, jump host, cellular modem, remote desktop, the integrator’s own tooling, all of it. Then ask who approved each path, and who would notice if one of them changed. Sit quietly after that one.

What you learn, in rough order of value:

• Whether they have ever inventoried this. Most have not. The honest ones say so within about four seconds and then tell you how they would go about it, which is the answer you actually want.
• The drawing has a shape. Flat, with the business network and the control network touching in three undocumented places, is the shape of a real plant. A textbook Purdue diagram with clean levels and no exceptions is the shape of somebody describing a slide they once saw.
• The vendor path. Almost every site has one, almost nobody lists it, and a candidate who volunteers it unprompted has been through either an incident or an audit.
• Ask when they last restored a SCADA server, rather than backed one up. There is usually a pause here. The length of the pause is the finding.
• What happens to the historian during a network partition? Store and forward, buffer depth, what gets lost, and what backfills. This separates configuration people from system people faster than anything else in the loop.

Certifications come up on every intake call, so briefly. An ISA/IEC 62443 certificate says somebody sat with the standard, which puts them ahead of most of the field. It does not tell you whether they will notice the modem. Tiebreaker, not filter. Every time.

Name the Platform in the Job Title

“SCADA experience required” filters approximately nobody. Zero people.

The supervisory layer has ecosystems the way the PLC layer does, and they are not dialects of one language. Ignition from Inductive Automation, with unlimited tags per server, Python scripting, and OPC UA out to anything, which is why integrators and mixed-vendor plants gravitate toward it. FactoryTalk View SE where the floor is Rockwell. WinCC where it is Siemens. AVEVA, still called Wonderware by half the people who run it, across process industries and older installations. Then iFIX, VTScada, and a long tail nobody advertises.

Somebody with nine years in FactoryTalk View can learn Ignition. A good one will, and reasonably fast, because the concepts transfer even where nothing else does. They will not be productive in your first quarter. Candidates who tell you the platforms are basically the same have usually done a two-day training course and one small greenfield project where nobody was standing behind them asking when the line comes back.

So put yours in the title. “SCADA Engineer, Ignition” does more filtering than the twelve bullets underneath it, and it does that filtering before anyone spends twenty minutes in your application portal.

Two things sit right next to the platform and get omitted even more often. Say which historian you run, because a validated batch historian in a regulated plant and a time-series database at a solar site are different skills wearing one word. And say whether OPC UA is already deployed or whether your new hire is the person who will deploy it. Different job. Different candidate. Different band.

A Search That Closes in Six Weeks

Our IT searches average seventeen days end to end. This one runs longer, and I would rather say so than quote a number we will miss. Six weeks from approved requisition to accepted offer is realistic when these happen in this order.

1. Pick your row from the table above and write one sentence. Put it in the first paragraph of the requisition. If your operations lead and your IT director would write different sentences, settle that before you post, because the disagreement resurfaces at offer stage and costs you the candidate.
2. Name the SCADA platform and the historian in the title or the first three lines. Costs nothing. Changes who applies. Immediately.
3. Decide whether remote access and network segmentation belong to this person. Write the answer down either way. If they do, price the role accordingly and say so in the posting, because the people already carrying that work know what it is worth.
4. Publish the schedule. Commissioning windows, planned shutdowns, on-call rotation, and whether the SCADA cutover lands on a weekend. Ambush at week six is the single most common way we watch these searches restart, because a candidate who accepts a job already knowing about the Sunday cutover window will stay through three of them, and a candidate who finds out about it after signing will be gone before the second.
5. Screen with the drawing exercise instead of a platform quiz. Fifteen minutes inside the technical screen covers it. Candidates prefer it, which matters when they have two other processes running.
6. Decide within a week of the final panel. Two weeks of internal deliberation loses the hire. Reliably. Ask us.

For a capital project with a defined end, or a first SCADA cutover where you are not yet sure the headcount is permanent, contract staffing gets the work done without the commitment. Utilities and manufacturers do this constantly. Six months of contract, then convert once the work turns out to be continuous.

Some of You Should Not Make This Hire

Our revenue depends on placements. Read the next few paragraphs knowing that, because they argue against our own invoice.

If you run one facility, your integrator has held the contract for six years and answers the phone, and your SCADA system has not changed materially since commissioning, then a full-time SCADA engineer is probably not the right purchase. The better spend is smaller and considerably less satisfying. Pay the integrator for a documented asset inventory that includes every remote access path. Get a tested restore, meaning somebody actually stands up the SCADA server from backup on other hardware while you watch the clock. Then put a controls-capable person on staff who owns the relationship and knows enough to ask uncomfortable questions.

Costs a fraction of a salaried hire. Closes most of what the advisories describe. I would rather see you spend eleven thousand with your integrator this quarter than a hundred and thirty thousand a year on somebody whose real job turns out to be waiting around for something to happen.

Three things move the threshold. A second site, because now somebody has to decide whether the two systems converge or stay separate and your integrator has a financial opinion about that. A compliance obligation with a date attached to it. Or the week your insurer or your largest customer sends a questionnaire you cannot answer, which is honestly how most of these conversations start.

The SANS and GIAC 2026 Cybersecurity Workforce Research Report, drawn from 947 respondents, found something worth carrying into this decision. Sixty percent named “not having the right staff” as their core problem, against forty percent who named “not enough staff,” the first time in the report’s three-year run that capability decisively beat headcount, and the margin widened from four points to twenty inside a single year. Twenty-seven percent tied a breach directly to a capability gap.

Hiring a body does not close a capability gap. It hides one. Two or three quarters, in our experience, which is roughly how long it takes for the first real incident or the first serious audit to arrive and settle what the person you hired can and cannot actually do.

Six Questions Plant and Utility Managers Ask Us

Our integrator already handles all of this. Why would we hire anyone?

Integrators build and hand off. Somebody on your payroll still has to own the system between projects, and that gap is where undocumented remote access paths and untested backups accumulate. It is the exact gap the CISA advisories keep describing.

Plenty of single-site operations are genuinely fine with a strong integrator relationship and no internal SCADA headcount. The tell is whether you can answer a security questionnaire without emailing them first.

Can our controls engineer just pick up the SCADA side?

Often yes, and it is usually the cheapest path available. Give them the historian, the server administration, and the network conversation as written responsibilities, plus actual hours. Assumed ownership is how a system drifts for a year while everyone assumes somebody else is watching it.

Where it breaks down is scale. One site with a few hundred tags, fine. Multiple sites with redundancy, remote access for a dozen vendors, and a historian feeding regulatory reporting is a job, not an addition to one.

Realistically, how much of this role is cybersecurity now?

About a third, and the share keeps growing. Asset inventory, remote access control, PLC password hygiene, and network segmentation are SCADA engineering tasks that no security operations team will perform on your behalf.

The other two-thirds is still screens, tags, alarms, historians, and reports, which is the part of the job that happens every week rather than the part that happens the month after an advisory drops. Candidates who present as pure OT security specialists are usually the wrong fit for a role that also owns alarm rationalization, and they get bored by month five.

We run Ignition. Does that shrink the pool or grow it?

Ignition grows it. The platform is common at system integrators, so the trained population is broad, and its OPC UA layer means candidates from mixed-vendor environments transfer in cleanly. Name it in the job title.

Legacy AVEVA and older FactoryTalk installations are the harder searches. People who know those environments well tend to be senior, comfortably employed, and nowhere near a job board, so plan on direct outreach and plan on the first three conversations being about whether they are open at all rather than about your requirements.

What should the first ninety days actually produce?

A remote access inventory that matches reality, one tested restore of a SCADA server onto different hardware, and a first pass at alarm rationalization. Three deliverables. Nothing to procure.

Be wary of the candidate whose opening move is a platform migration. Sometimes that is right. More often it postpones the unglamorous inventory work, and the inventory is what makes every later decision cheaper and every audit shorter.

The good ones all seem to work for integrators. How do we compete?

Compete on the schedule rather than on the salary. Integrator work carries heavy travel and commissioning weekends, and engineers with young families leave it for predictable hours far more readily than for a raise.

Put the number in the posting. “Roughly 10% travel, no regular weekend work outside two annual shutdowns” reads as a real offer to somebody who spent last year in hotels. This is also where an agency earns its fee or does not. Our recruiters average 15+ years on the desk and hold a 92% twelve-month retention rate on placements, across 30+ US metros. Ask any firm you talk to for their retention number, not their fill time.

Write the Req Like You Have Read This

Decide which of the four rows you are hiring. Name the platform and the historian. State whether remote access belongs to this person, and pay for it if it does. Publish the schedule honestly. Screen by asking them to draw the path in.

Then move quickly, because the shortlist for this role is short. Genuinely short.

If you want a second read on the requisition before it goes live, or a shortlist instead of a job board, put the search in front of our recruiting team. We staff SCADA, controls, and OT roles on contract, contract-to-hire, and direct hire terms across manufacturing and power and utility environments, and the first call is usually about scope rather than fees.